Decapsulation Reveals Fake Chips

A while back, [heypete] needed to get a GPS timing receiver talking to a Raspberry Pi. The receiver only spoke RS-232, and the Pi is TTL level serial. [Pete] picked up a few RS-232 to TTL conversion boards from an online vendor in China. These boards were supposedly based on the Max3232, a wonderchip that converts the TTL serial to the positive and negative voltages of RS-232 serial. The converters worked fine for a few weeks, before failing, passing a bunch of current, and overheating.

On Mouser and Digikey, the Max3232 costs about $1.80 in quantity one, and shipping is extra. You can pick up a ‘Max3232 converter board’ from the usual online marketplaces for seventy five cents with free shipping. Of course the Chinese version is fake. [Pete] had some nitric acid, and decided to compare the die of the real and fake Max3232s.

After desoldering two fake chips from their respective converter boards, and acquiring a legitimate chip straight from Maxim, [Pete] took a look at the chips under the microscope. The laser markings on the fakes are inconsistent, but there was something interesting to be found in the date code markings. It took two to four weeks for the fake chips to be etched with a date code, assembled into a converter board, shipped across the planet, put into [Pete]’s project, run for a little bit, and fail spectacularly. That’s an astonishing display of manufacturing, logistics, and shipping times. Update: The date codes on the fakes had 2013 laser etched on the plastic package, and 2009 on the die. The real chips had a date code just a few weeks before [Pete] decapped them — a remarkably short life but they gave in to a good cause.

Following the Zeptobars and CCC (PDF) guides to dropping acid, [Pete] turned his problem into solution and took a look at the dies under a microscope. The legitimate die was significantly larger, and the fake dies were identical. The official die used gold bond wires, but the fake ones didn’t.

Unfortunately, [Pete] isn’t an expert in VLSI, chip design, failure analysis, or making semiconductors out of sand. Anything that should be obvious to the layman is not, and [Pete] has no idea why these chips would work for a week, then overheat and fail. If anyone has an idea, hit [Pete] up and drop a note in the comments.

Russian Decapping Madness

It all started off innocently enough. [mretro] was curious about what was inside a sealed metal box, took a hacksaw to it and posted photographs up on the Interwebs. Over one hundred forum pages and several years later, the thread called (at least in Google Translate) “dissecting room” continues to amaze.

h_1466184174_4168461_2f4afb42b7If you like die shots, decaps, or teardowns of oddball Russian parts, this is like drinking from a firehose. You can of course translate the website, but it’s more fun to open it up in Russian and have a guess at what everything is before peeking. (Hint: don’t look at the part numbers. NE555 is apparently “NE555” in Russian.)

From a brief survey, a lot of these seem to be radio parts, and a lot of it is retro or obsolete. Forum user [lalka] seems to have opened up one of every possible Russian oscillator circuit. The website loads unfortunately slowly, at least where we are, but bear in mind that it’s got a lot of images. And if your fingers tire of clicking, note that the URL ends with the forum page number. It’d be a snap to web-scrape the whole darn thing overnight.

We love teardowns and chip shots, of old gear and of new. So when you think you’ve got a fake part, or if you need to gain access to stuff under that epoxy blob for whatever reason, no matter how embarrassing, bring along a camera and let us know!

Thanks [cfavreau] for the great tip!

Dirt Cheap Dirty Decapping

Those tiny black rectangles of epoxy aren’t black boxes anymore. Decapsulating ICs is becoming somewhat common, and if you’re reverse engineering a chip-on-board epoxy blob, or just figuring out if the chip you bought is the chip you wanted, you’ll need to drop some acid. Usually this means finding someone with the knowhow to decap a chip, or having enough confidence in yourself to mess around with fuming nitric acid. Now Dangerous Prototypes has a better solution – Dirty Decapsulation. Send your chip to Dangerous Prototypes, and they’ll melt away the epoxy and take a few pictures of the die hidden inside your chip.

dirty-decappingDirty Decapsulation is Dangerous Prototype’s addition to their array of hacker services including cheap, crappy PCBs and SLA printing service. Dirty Decapsulation follows in the tradition of these other services; it’s not the best you can possibly get, but you’re not paying thousands of dollars for the job.

Right now, Dirty Decapsulation will take a chip, strip off the epoxy, and take a few pictures. These pictures are stitched together, producing a medium quality image of the die. No, you can’t see individual gates, and you can’t see different layers of metal and silicon. If you want that, you’ll need some nitric or a few thousand dollars. Dirty Decapsulation is just to verify the chip’s identity and give a rough idea of the layout of the die.

A Peek Under the Hood of the 741 Op-Amp

First introduced as an IC back in 1968, but with roots that go back to 1941, the 741 has been tweaked and optimized over the years and is arguably the canonical op-amp. [Ken Shirriff] decided to take a look inside everybody’s favorite op-amp, and ended up with some good-looking photomicrographs and a lot of background on the chip.

canRather than risk the boiling acid method commonly used to decap epoxy-potted ICs, [Ken] wisely chose a TO-99 can format to attack with a hacksaw. With the die laid bare for his microscope, he was able to locate all the major components and show how each is implemented in silicon. Particularly fascinating is the difference between the construction of NPN and PNP transistors, and the concept of “current mirrors” as constant current sources. And he even whipped up a handy interactive chip viewer – click on something in the die image and find out which component it is on the 741 schematic. Very nice.

We’ve seen lots of chip decappings before, including this reveal of TTL and CMOS logic chips. It’s nice to see the guts of the venerable 741 on display, though, and [Ken]’s tour is both a great primer for the newbie and a solid review for the older hands. Don’t miss the little slice of history he included at the end of the post.

CO2 Laser Decapping to Fix Soldering Mistake

[Carsten] messed up. He was soldering an ARM CPU onto a quadcopter board in haste, failed to notice that the soldering iron was turned up to eleven, and pulled some of the traces up off the PCB. In the process of trying to fix that, he broke three pins off of the 100-pin CPU. The situation was going from bad to worse.

Instead of admitting defeat, or maybe reflowing the CPU off of the board, [Carsten] lasered the epoxy case off of the chip down to the lead frame and worked a little magic with some magnet wire. A sweet piece of work, to be sure!

Continue reading “CO2 Laser Decapping to Fix Soldering Mistake”

Using a Laser Cutter to Decap ICs

The black blob IC is of a particular annoyance to the modern hacker. There is no harm in peeking under the hood to see how the IC works. But when it’s covered in a mountain of seemingly indestructible epoxy, this can be a bit difficult. And such was the case for [Jamie], who had found an old electronic pocket dictionary whose main PC board boasted not one, but two of the black blob ICs.

ICThe lack of traces between the two pushed [Jamie’s] curiosity past the tipping point. He didn’t have access to any nitric acid which is used in the customary chemical decapping process. He did, however, have access to a laser cutter. It turns out that decapping ICs with a laser cutter is not only possible, it’s not that difficult.

100% power at 300mm per seconds on a cheap 40 Watt “eBay” laser cutter is all it takes. Three passes did the trick for [Jamie], but this will be dependent on the thickness of the black blob epoxy. Each case will likely be unique.

Got a laser cutter? Then take a peek at a few black blob ICs and let us know what you find.

Thanks to [ex-parrot] for the tip!

Looking inside the KR580VM80A Soviet i8080 clone

The folks at Zeptobars are on a roll, sometimes looking deep inside historic chips and at others exposing fake devices for our benefit. Behind all of those amazing die shots are hundreds of hours of hard work. [Mikhail] from Zeptobars recently tipped us off on the phenomenal work done by engineer [Vslav] who spent over 1000 hours reverse engineering the Soviet KR580VM80A – one of the most popular micro-controllers of the era and a direct clone of the i8080.

But before [Vslav] could get down to creating the schematic and Verilog model, the chip needed to be de-capped and etched. As they etched down, they created a series of high resolution images of the die. At the end of that process, they were able to determine that the chip had exactly 4758 transistors (contrary to rumors of 6000 or 4500). With the images done, they were able to annotate the various parts of the die, create a Verilog model and the schematic. A tough compatibility test confirmed the veracity of their Verilog model. All of the source data is available via a (CC-BY-3.0) license from their website. If this looks interesting, do check out some of their work that we have featured earlier like comparing real and fake Nordic dies and amazing descriptions of how they figure out the workings of these decapped chips. If this is too deep for you check out the slightly simpler but equally awesome process of delayering PCBs.